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OVERVIEW 

The  views  presented  in  this  paper  are  those  of  the  author  and 
should  not  be  construed  as  representing  official  Federal 
Aviation  Administration  rules  interpretation  or  policy. 

Part  29.571  of  reference  [1]  contains  several  strategies  that, 
with  certain  qualification,  applicants  are  allowed  to  adopt  to 
ensure  adequate  structural  integrity  throughout  the 
operational  life  of  a rotorcraft.  There  has  been  a continuing 
debate  concerning  the  merits  of  the  various  strategies.  Much 
of  the  discussion  has  centered  on  the  damage  tolerance  versus 
the  flaw  tolerance  philosophies  and  the  pros  and  cons  of  each. 
Additionally,  the  appropriate  role  of  the  traditional  safe-life 
philosophy  has  been  debated  at  length. 

This  paper  begins  by  considering  what  the  objective  of  Part 
29.571  is  and  then  examines  each  of  the  strategies  and  their 
strengths  and  weaknesses.  Following  this  a recommended 
strategy  is  proposed  which  is  believed  to  offer  the  most 
rational  path  at  the  present  time  to  achieving  the  stated 
objective. 

INTRODUCTION 

The  primary  objective  of  Part  29.571  is  to  mitigate 
catastrophic  failures  due  to  fatigue  by  maintaining  a 
minimum  level  of  structural  integrity  throughout  a structure’s 
operating  life.  The  level  of  structural  integrity  that  a newly 
delivered  rotorcraft  must  be  shown  to  have  is  defined  in  Part 
29.305  of  reference  [1].  In  short  the  structure  must  be  able  to 
support  limit  loads  without  detrimental  or  permanent 
deformation  and  ultimate  loads  without  failure  where  ultimate 
loads  are  1 .5  times  limit.  Compliance  is  generally  shown  by  a 
combination  of  analysis  and  testing  of  structure  that  is  as 
representative  as  possible  of  the  production  design  and  free 
from  any  known  defects.  This  level  of  structural  integrity  will 
be  referred  to  as  the  “baseline  integrity”  that  each  structure  is 
required  to  begin  life  with.  It  is  also  one  of  the  basic  type 
design  requirements.  Additionally,  Part  21.183  of  reference 
[1]  implies  that  for  an  aircraft  to  be  considered  airworthy  it 
must  always  conform  to  type  design. 

Based  on  the  above  it  is  believed  that  maintenance  of  baseline 
integrity  must  always  be  considered  when  evaluating 
philosophies  aimed  at  precluding  catastrophic  failures  due  to 
fatigue.  Consistent  with  this  has  been  the  FAA’s  “flyable 
cracks”  policy  which  has  always  included  a requirement  to 
show  ultimate  load  capability,  with  a known  crack,  as  a 
fundamental  prerequisite  before  considering  continued 


operation  without  repair.  Also  consistent  with  this  line  of 
thinking  is  the  requirement  to  apply  the  basic  type  design 
requirements  of  Part  29.305  of  reference  [1]  to  any  repairs  or 
modifications  to  operational  aircraft  regardless  of  age.  There 
are,  in  short,  no  provisions  for  relaxing  structural  integrity 
requirements  as  a structure  ages. 

THREATS  TO  STRUCTURAL  INTEGRITY 

For  a new  structure  whose  design  is  certified  and  which 
possesses  an  airworthiness  certificate  the  probability  of 
catastrophic  failure  due  to  fatigue  should  be  zero.  This 
follows  from  the  fact  that  the  probability  of  meeting  the 
strength  and  deformation  requirements  of  Part  29.305  of 
reference  [1]  should  be  1.0  and  that  it  has  not  experienced 
any  cyclic  loading.  However,  once  it  is  put  into  service  there 
are  many  mechanisms  that  can  give  rise  to  fatigue  cracks  and 
eventually  lead  to  catastrophic  failure.  For  the  following 
discussion  these  mechanisms,  or  threats  to  structural  integrity, 
are  divided  into  two  categories.  The  first  category  will 
contain  those  mechanisms  which  will  lead  to  “normal” 
fatigue.  The  second  category  will  contain  those  mechanisms 
which  could  lead  to  “anomalous”  fatigue. 

Normal  Fatigue 

Normal  fatigue  is  the  expected,  inevitable  (if  we  are  operating 
above  the  endurance  limit)  fatigue  that  will  occur  if  a 
structure  was  designed  without  error,  manufactured  as 
planned  and  operated  and  serviced  as  expected.  Normal 
fatigue  is  predictable  and  the  probability  of  it  occurring  is 
steadily  increasing  with  time.  Traditional  fatigue  testing  is 
performed  to  characterize  normal  fatigue  at  the  detail, 
component  and  aircraft  level.  If  one  defines  a discrete 
endpoint  to  life,  such  as  the  appearance  of  a 1 mm  crack,  the 
time  to  reach  that  endpoint  typically  follows  a statistical 
distribution.  Normal,  Log  Normal  and  Weibul  distributions 
are  typically  used  to  characterize  the  behavior.  Given  a 
statistical  distribution  of  life  to  a defined  endpoint  the 
degradation  of  failure  strength  capability  with  time  can  be 
conceptually  depicted  as  shown  in  figure  1 . This  assumes  the 
structure  had  some  small  margin  of  strength  above  the  basic 
requirement.  The  cumulative  probability  of  reaching  a fatigue 
state  such  that  the  structure  will  fail  at  ultimate  load  is  shown 
by  a solid  curve  and  the  limit  critical  cumulative  probability 
is  given  by  the  dashed  curve.  It  follows  that  point  A 
represents  the  average  time  to  degrade  to  ultimate  capability 
and  point  B is  the  average  time  to  degrade  to  limit.  This  also 
illustrates  that  there  is  some  period  of  time  during  which  a 
structure  can  be  considered  to  be  virtually  crack  free  and 
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therefore  expected  to  meet  the  baseline  integrity  requirements 
with  high  probably. 


Figure  1 Degradation  of  strength  with  time  due  to  normal 
fatigue  (50%  probability) 

Anomalous  Fatigue 


Anomalous  fatigue  occurs  due  to  unexpected  and 
unpredictable  events.  Sources  of  anomalous  fatigue  include 
but  are  not  limited  to: 


• Design  oversights/errors 

• underestimating  external  loads 

• underestimating  internal  loads 

• underestimating  peak  stresses 

• Manufacturing  errors/mistakes 

• omission  of  critical  processes 

• introduction  of  defects 

• Operational  and  service  anomalies 

• severe  usage  (relative  to  expected) 

• service  induced  defects 


Considerable  effort  is  made  during  design  and  manufacture  to 
mitigate  the  risk  of  anomalous  fatigue.  Likewise,  controls  are 
typically  put  into  place  once  an  aircraft  enters  service  to 
minimize  the  risk  of  operational  and  service  related 
anomalies.  However,  in  spite  of  our  best  intentions, 
anomalous  fatigue  does  occur  and  can  result  in  increased 
maintenance  costs  at  best  and  loss  of  aircraft  and  life  at  worst. 


TIME 


Figure  2 Degradation  of  strength  with  time  due  to 
anomalous  fatigue 

THREAT  STRATEGIES 


Strategies  employed  to  deal  with  the  threat  of  normal  and 
anomalous  fatigue  are  discussed  below.  It  is  argued  that  the 
traditional  safe-life  philosophy  and  damage  tolerance 
philosophy  can  be  used  to  effectively  deal  with  normal  and 
anomalous  fatigue  respectively.  The  flaw  tolerance 

philosophy  is  also  discussed  since  it  is  currently  included  as 
an  acceptable  strategy  in  Part  29.571  of  reference  [1]. 
However,  it  is  suggested  that  the  flaw  tolerance  philosophy  is 
unduly  pessimistic  relative  to  the  normal  fatigue  threat  and 
inadequate  with  respect  to  the  anomalous  fatigue  threat. 

Safe-Life  Philosophy 

Before  going  further  with  this  discussion  it  is  considered 
necessary  to  clarify  the  author’s  definition  of  “safe-life” 
within  the  context  of  this  paper.  Two  existing  definitions  are 
referenced  for  purposes  of  discussion.  The  first  definition  is 
given  in  reference  [2]  and  is  as  follows: 

“Safe-Life  means  that  the  structure  has  been 
evaluated  to  be  able  to  withstand  the  repeated  loads 
of  variable  magnitude  expected  during  service 
without  detectable  cracks.” 


The  degradation  of  failure  strength  capability  due  to 
anomalous  fatigue  can  be  conceptually  depicted  as  shown  in 
figure  2.  Curve  1 is  the  degradation  of  strength  due  to  normal 
fatigue  and  is  included  for  reference.  Curves  2-6  depict 
degradation  due  to  anomalous  fatigue.  Since  the  time  of 
occurrence  of  the  anomaly  and  its  severity  are  unpredictable 
by  definition  any  reliable  statistical  modeling  is  questionable. 
The  flat  dashed  curve  is  meant  to  depict  the  cumulative 
probability  of  anomalous  fatigue  occurring.  As  was  discussed 
above  concerted  efforts  are  typically  made  to  drive  this  to  as 
near  zero  as  possible.  While  it  may  be  argued  that  there  is 
some  increase  in  cumulative  probability  with  time  (e.g.  due  to 
increased  exposure  to  anomalous  sources)  it  might  be 
considered  to  be  relatively  low  and  virtually  constant. 


The  second  definition  is  given  in  reference  [3]  and  is  as 
follows: 

“Safe-Life  of  a structure  is  that  number  of  events 
such  as  flights,  landings,  or  flight  hours,  during 
which  there  is  a low  probability  that  the  strength 
will  degrade  below  its  ultimate  value  due  to  fatigue 
cracking.” 

The  first  definition  correlates  best  with  the  words  that 
currently  exist  in  the  safe-life  rules  of  reference  [1],  Here  the 
focus  is  on  the  absence  of  detectable  cracks.  It  is  suggested 
that  this  focus  can  result  in  some  ambiguity  since  what  is 
detectable  is  a function  of  the  inspection  method.  With 
inspection  methods  improving  with  time  this  definition  is 
somewhat  of  a moving  target  and  therefore  less  than 
adequate. 
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The  second  definition  focuses  on  the  baseline  integrity 
discussed  in  the  beginning  of  the  paper.  This  focus  is 
unambiguous  and  follows  directly  from  the  requirements  of 
reference  [1]  for  type  design  and  airworthiness  certification. 
Because  of  this  it  is  suggested  that  it  is  the  most  appropriate 
and  will  be  the  definition  used  in  the  context  of  this 
discussion. 


REPLACEMENT  TIME 


Figure  3 Application  of  traditional  safe-life  philosophy 

Based  on  the  second  definition  of  safe-life  discussed  above 
and  the  nature  of  normal  fatigue  as  depicted  in  figure  1 it  is 
concluded  that  the  traditional  safe-life  philosophy  is  adequate 
for  dealing  with  the  normal  fatigue  threat.  This  is 
conceptually  depicted  in  figure  3.  An  average  fatigue  life  is 
established  based  on  analysis  and  test  for  a nominal  part  free 
from  known  defects.  A factor  is  then  applied  to  this  life  to 
establish  a replacement  time  when  the  part  is  to  be  removed 
from  service.  Figure  3 illustrates  the  case  of  the  replacement 
time  being  based  on  some  fraction  of  the  average  time  to 
develop  cracking  which  would  cause  the  structure  to  fail  at 
limit  load.  Distributions  of  life  to  ultimate  critical  and  sub 
limit  critical  are  also  depicted.  It  is  believed  that,  in  the  past, 
average  lives  associated  with  fatigue  states,  that  did  not 
degrade  the  failure  strength  below  ultimate,  have  often  been 
used.  In  this  case  a replacement  time  based  on  Njj/f  would 
certainly  result  in  “low  probability  that  the  strength  will 
degrade  below  its  design  ultimate  value  due  to  fatigue 
cracking.”  For  the  scenarios  where  the  average  fatigue  life 
corresponds  to  fatigue  states  where  the  failure  strength  is 
below  ultimate  the  probability  of  having  a fielded  part’s 
failure  strength  degrade  below  ultimate  may  be  higher  but 
still  may  be  acceptably  low  depending  on  the  value  of  f used. 
This  is  also  illustrated  in  figure  3 for  the  case  where  Nl  is 
used.  The  retirement  life  is  given  by  Ni/f  and  the  cumulative 
probability  of  failing  below  ultimate  is  small  and  represented 
by  the  fractional  shaded  area  under  the  life  to  ultimate  critical 
distribution  curve. 

A frequent  deficiency  of  the  safe-life  philosophy  as  currently 
applied  is  the  failure  to  quantify  the  fatigue  state  being 
addressed  and  its  impact  on  failure  strength.  It  is  suggested 
that  this  should  be  corrected  in  the  future  so  that  there  is  no 
ambiguity  relative  to  meeting  the  stated  objective.  Beyond 
this  it  may  be  desirable  to  quantify  the  cumulative  probability 
of  the  strength  degrading  below  ultimate  at  the  replacement 
time. 


Damage  Tolerance  Philosophy 

Reference  [4]  discusses  the  adoption  of  a damage  tolerance 
philosophy  by  the  USAF.  As  discussed  in  the  reference  the 
primary  motivation  was  the  recognition  that  anomalous 
fatigue  was  a significant  threat  that  had  to  be  dealt  with  and 
that  it  wasn’t  being  adequately  taken  care  of  by  the  safe-life 
philosophy  which  had  been  previously  employed.  The  USAF 
requirements,  which  derive  from  their  philosophy,  were 
originally  specified  in  reference  [5],  It  has  been  noted  on 
numerous  occasions,  (e.g.  see  reference  [6]),  that  anomalous 
fatigue  due  to  manufacturing  and  in-service  damage  has  been 
successfully  controlled  in  the  USAF  fleet  through  the 
adoption  of  the  damage  tolerance  approach  in  1975.  The 
common  ground  between  the  USAF  damage  tolerance 
philosophy  and  the  one  promoted  herein  is  the  requirement  to 
assume  a fatigue  crack(s),  perform  a damage  tolerance 
evaluation  using  fracture  mechanics  principles  and  establish 
inspection  requirements  consistent  with  the  damage  tolerance 
characteristics  of  the  structure.  Additionally,  the  USAF 
requirements  specify  crack  sizes  to  be  assumed  and  set 
minimum  acceptable  standards  for  crack  growth  life  and 
inspection  intervals.  The  key  difference  between  the  USAF 
philosophy  and  the  one  in  reference  [1]  is  that  the  USAF 
requirements  result  not  only  in  a damage  tolerance  based 
inspection  program  but  also  a minimum  acceptable  level  of 
tolerance  to  damage.  In  comparison,  a design  which  is  not 
inherently  damage  tolerant  can  still  be  found  in  compliance 
with  reference  [1]  provided  the  inspection  requirements 
match  its  damage  tolerance  characteristics  (however  good  or 
marginal  the  characteristics  might  be). 

The  damage  tolerance  philosophy  as  advocated  herein  is 
based  on  (1)  the  assumption  of  a crack(s),  (2)  characterization 
of  the  growth  and  impact  on  strength  of  the  crack(s),  (3) 
assurance  of  a minimum  strength  equal  to  the  highest  loading 
that  could  be  expected  within  the  design  operating  envelop 
(e.g.  limit  load),  (4)  establishment  of  inspection  requirements 
consistent  with  the  damage  tolerance  characteristics  of  the 
structure  and  (5)  implementation  of  inspections.  It  should  be 
noted  here  that  the  setting  of  inspection  requirements  based 
on  the  assumption  of  anomalous  defects,  and  insuring  no 
failure  at  “limit”  load,  is  only  applicable  to  the  period  of  time 
during  which  normal  fatigue  cracking  is  not  expected  to 
occur  (i.e.  low  cumulative  probability).  Beyond  this  point 
additional  action  must  be  taken  to  deal  with  the  constantly 
increasing  probability  of  normal  fatigue.  As  discussed  above, 
replacement  based  on  the  traditional  safe-life  philosophy 
would  be  one  way  to  deal  with  this. 

It  is  believed  that  while  no  philosophy  can  be  expected  to 
precluded  catastrophic  failures  due  to  fatigue  with  100% 
certainty  the  damage  tolerance  philosophy  provides  the  best 
protection  against  anomalous  fatigue  due  to  the  kind  of 
mechanisms  previously  noted.  One  of  its  strongest  assets  is 
that  it  deals  directly  with  cracks  which  are,  in  the  end,  what 
cause  the  failure.  The  damage  tolerance  philosophy  forces 
one  to  consider  how  a structure  behaves  with  cracks  and  this 
insight  can  be  used  to  modify  the  design  such  that  there  is  at 


17-4 


least  a minimum  level  of  tolerance  to  cracks.  It  also  generates 
inspections  that  are  geared  to  detect  what  actually  causes  a 
structure  to  fail  (i.e.  cracks).  A damage  tolerance  philosophy 
can  even  be  of  benefit  for  anomalous  fatigue  due  to  design 
errors  and  severe  usage  that  results  in  unexpected  cracking. 
Even  if  the  inspection  intervals  and  inspections  methods  are 
not  optimum  for  the  subject  cracking  there  will  be  some 
probability  of  precluding  a failure  because  one  is  inspecting 
in  the  right  location  for  the  right  thing. 

Another  ancillary  benefit  of  a damage  tolerance  based 
inspection  program  is  the  additional  protection  from  the 
normal  fatigue  threat  that  it  provides.  Since  inspections  are 
typically  defined  to  detect  cracks  in  fatigue  critical  areas 
premature  “normal”  cracking  will  have  a measurable 
probability  of  being  detected  if  it  should  occur  before  the 
replacement  time  is  reached.  In  this  case  the  replacement  time 
could  be  reassessed  to  mitigate  any  potential  risk  to  the  fleet. 
Consistent  with  this  it  might  be  feasible  to  depart  from 
tradition  and  be  less  conservative  with  the  factor,  f,  used  to 
determine  the  replacement  time,  provided  that  a damage 
tolerance  inspection  program  is  in  place.  This  notion  is 
discussed  in  more  detail  below. 

Flaw  Tolerance  Philosophy 

The  flaw  tolerance  philosophy  is  included  as  an  alternative  to 
the  damage  tolerance  philosophy  in  showing  compliance  with 
Part  29.571  of  reference  [1].  This  philosophy  focuses  on 
crack  initiation  from  defects  that  might  be  envisioned  to 
occur  during  manufacture  or  in  the  service  life  of  the 
structure.  Traditional  safe-life  methodology  is  employed 
using  fatigue  data  for  intentionally  flawed  test  specimens. 
Replacement  times  are  derived  from  test  data  for  “barely 
detectable”  flawed  specimens  and  in-service  inspection 
requirements  are  derived  from  test  data  for  “clearly 
detectable”  flawed  specimens. 

In  general,  the  flaws  to  be  considered  are  not  cracks  but 
instead  include  nicks,  dents,  scratches,  fretting  or  corrosion 
that  may  occur  during  manufacture  or  during  the  service  life 
of  the  structure.  Application  of  the  flaw  tolerance  philosophy 
requires  the  determination  of  the  maximum  probable 
undetectable  and  clearly  detectable  flaw  sizes  and  critical 
locations  based  on  a review  of  historical  data  and 
manufacturing  processes.  It  is  implicitly  assumed  that  the 
impact  on  baseline  integrity  of  these  threats  is  conceptually 
the  same  as  depicted  for  normal  fatigue  as  shown  in  figure  1 . 
That  is,  there  is  some  quantifiable  crack  initiation  phase 
followed  by  a crack  growth  phase  and  that  the  time  to  initiate 
a crack  follows  a statistical  distribution  which  can  be 
established  based  on  fatigue  testing  of  flawed  specimens 
and/or  flawed  production  components.  The  degradation  of 
strength  with  time  trend  is  conceptually  illustrated  in  figure  4 
for  a production  part  without  flaws,  with  barely  detectable 
flaws  and  with  clearly  detectable  flaws. 


Figure  4 Impact  of  flaw  tolerant  flaws  (50%  probability) 

It  is  the  author’s  opinion  that  while  the  flaw  tolerance 
philosophy  could  be  considered  an  acceptable,  but 
pessimistic,  alternative  to  the  traditional  safe-life  philosophy 
it  should  not  be  considered  an  acceptable  alternative  to  the 
damage  tolerance  philosophy. 

The  flaw  tolerance  philosophy  sets  replacement  times  based 
on  flawed  part  crack  initiation  life.  The  flaws  considered  are 
those  that  could  go  undetected  during  the  manufacturing 
process  and  reduce  the  life  below  that  of  a “properly” 
manufactured  part.  This  approach  could  easily  yield 
replacement  times  that  are  less  that  those  that  would  be  set 
based  on  the  traditional  safe-life  philosophy.  This  would 
appear  to  unduly  penalize  the  majority  of  the  population, 
make  part  replacement  more  of  an  economic  burden  than  it  is 
now  and  not  significantly  help  mitigate  the  anomalous  fatigue 
threat. 

The  flaw  tolerance  approach  establishes  inspection 
requirements  based  on  precluding  crack  initiation  from  an  in- 
service  detectable  flaw.  The  resulting  inspections  are  aimed  at 
detecting  dings,  bangs,  scratches,  corrosion,  etc.  and  the 
intervals  are  based  on  the  time  to  initiate  cracks  from  these 
kinds  of  defects.  While  in-service  inspections  should  be 
performed  to  look  for  these  kinds  of  flaws  this  in  itself  falls 
short  of  what  is  required.  It  is  difficult  to  imagine  that 
potential  flaw  sources  can  be  anticipated,  flaw  types 
characterized  and  severity  quantified  to  a degree  that  is 
sufficient  to  bound  all  significant  anomalous  threats  of  this 
nature.  It  is  also  believed  that  the  adequacy  of  the  bounding 
will  present  a major  dilemma  for  the  regulators.  The  flaw 
tolerance  philosophy  does  not  produce  inspections  that  have 
crack  detection  as  their  primary  objective.  This  is  a major 
deficiency  since  cracking  is  what  ultimately  results  in  failure 
The  bottom  line  is  that  an  inspector  who  is  looking  for  cracks 
has  a chance  of  finding  them  if  they  are  there  and  will  also 
detect  and  report  any  dents,  scratches,  corrosion,  etc.,  if 
present.  The  converse  is  not  necessarily  true.  Additionally, 
there  are  anomalous  threats  such  as  design  oversights/errors 
and  severe  usage  that  can  result  in  premature  cracking 
without  any  tell  tale  “clearly  detectable”  flaws  being  present. 
The  flaw  tolerance  philosophy  does  little  to  help  mitigate 
failures  due  to  these  threats. 
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A Proposed  Strategy 

It  is  suggested  that  an  appropriate  and  effective  strategy  for 
meeting  the  objective  of  Part  29.571  of  reference  [1]  would 
be  to  use  a traditional  safe-life  philosophy  to  deal  with  the 
threat  of  normal  fatigue  and  a damage  tolerance  philosophy 
to  deal  with  the  threat  of  anomalous  fatigue.  This  strategy 
would  have  two  primary  elements  which  are  summarized  as 
follows: 

1.  Establish  replacement  times  for  all  principle 
structural  elements  based  on  the  traditional 
safe-life  approach  and  remove  them  from 
service  before  there  is  any  significant 
probability  of  developing  cracks  due  to  normal 
fatigue.  Inherent  with  this  would  be  a high 
probability  that  the  baseline  integrity  would  be 
maintained  up  to  the  time  of  replacement. 

2.  Establish  in-service  inspection  requirements 
for  all  principle  structural  elements  based  on 
their  damage  tolerance  characteristics 
determined  from  a damage  tolerance 
evaluation  (supported  by  analysis  and  test) 
unless  it  could  be  shown  that  this  was 
impractical.  If  inspections  tied  rigidly  to  the 
damage  tolerance  characteristics  of  the 
structure  were  shown  to  be  impractical  detail 
inspections  of  critical  areas  for  cracking  would 
still  be  required  using  mutually  agreed  to  NDI 
methods  and  intervals  based  on  good 
engineering  judgment.  Additionally,  extra 
precautions  (e.g.  more  rigorous  detail  analysis, 
testing,  loads  monitoring,  etc.)  would  be 
required  for  these  parts  to  help  mitigate 
potential  sources  of  anomalies. 

The  proposed  strategy  is  based  on  the  concept  of  not  allowing 
parts  to  operate  beyond  a point  when  there  is  a significant 
probability  that  the  baseline  integrity  is  compromised  due  to 
normal  fatigue  and  rigorously  inspecting  the  parts  for 
potential  cracking  caused  by  anomalous  fatigue  up  to  that 
point.  A rigorous  inspection  program  must  be  derived  from 
the  results  of  a damage  tolerance  evaluation.  Ideally  the 
inspection  location,  method,  threshold  and  interval  would  all 
correlate  with  the  evaluation  results.  In  some  cases  this  might 
prove  to  be  impractical  however  inspections  for  cracks  in  the 
appropriate  areas  should  be  imposed  as  a minimum.  When  a 
completely  rigorous  inspection  program  is  practical, 
implementing  it  will  also  provide  an  additional  safeguard 
against  the  normal  fatigue  threat.  Because  of  this,  traditional 
“safety  factors”  on  life  and/or  fatigue  strength  might  be 
reduced  without  reducing  the  level  of  safety  achieved  with 
traditional  factors  but  without  damage  tolerance  based 
inspections. 


SUMMARY 


Structural  evaluations  must  be  performed  and  “inspections, 
replacement  times,  combinations  thereof,  or  other 
procedures”  must  be  defined  to  achieve  the  desired  result. 
Three  different  philosophies  are  recognized  in  the  rule.  Either 
the  flaw  tolerant  or  damage  tolerance  philosophies  must  be 
used  unless  the  applicant  establishes  that  these  philosophies 
cannot  be  practically  applied.  In  that  case  it  is  acceptable  to 
use  the  safe-life  philosophy. 

For  new  structure  we  can  divide  all  potential  fatigue  cracking 
into  two  categories.  One  is  “normal”  fatigue  which  is 
unavoidable,  inevitable  and  predictable.  The  second  is 
“anomalous”  fatigue  which  we  try  to  avoid  and  whose 
potential  occurrence  is  unpredictable.  Given  the  different 
nature  of  each  it  is  natural  that  two  different  strategies  must 
be  used  to  deal  with  each. 

Part  29.305  of  reference  [1]  contains  basic  structural  integrity 
requirements  for  strength  and  deformation.  These  are  basic 
type  design  requirements  and  per  Part  21.183  of  reference  [1] 
they  must  be  met  if  an  aircraft  is  to  be  considered  airworthy. 
These  fundamental  type  design  requirements  must  always  be 
kept  in  mind  when  considering  appropriate  strategies  to  be 
used  against  the  threat  to  structural  integrity  that  fatigue 
presents. 

The  flaw  tolerance  philosophy  should  be  dismissed  as  an 
inappropriate  strategy  for  dealing  with  both  normal  and 
anomalous  fatigue.  It  unduly  penalizes  the  majority  of  a part 
population  relative  to  the  normal  fatigue  threat  and  does  little 
to  help  mitigate  the  risks  associated  with  the  anomalous 
fatigue  threat.  The  fact  that  it  does  not  result  in  inspections 
that  are  devised  to  detect  cracks  is  also  a major  deficiency. 

An  effective  strategy  for  meeting  the  objective  of  part  29.571 
of  reference  [1]  and  maintaining  airworthiness  per  part 
21.1 83  of  reference  [1]  is  to  use  both  the  safe-life  and  damage 
tolerance  philosophies.  Replacement  times  are  specified 
based  on  the  safe-life  philosophy  and  parts  are  removed  from 
service  before  the  probability  of  normal  fatigue  and  not 
meeting  type  design  requirements  becomes  significant. 
Inspection  programs  are  established,  for  the  period  of  time 
during  which  normal  fatigue  is  not  expected  to  occur,  based 
on  the  damage  tolerance  characteristics  of  the  part. 
Implementation  of  these  inspections  would  adequately 
mitigate  risks  associated  with  anomalous  fatigue.  A caveat  to 
this  strategy  might  be  a reduction  in  the  magnitude  of 
traditional  “safety-factors”  used  to  define  replacement  times. 
This  could  result  in  significant  economic  benefits  without 
reducing  safety  levels  below  those  achieved  with  higher 
factors  but  without  damage  tolerance  based  inspections. 
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